CVE-2026-61749

Name of the Vulnerable Software and Affected Versions InvenTree versions prior to 1.4.0

Description Privileged staff users with permissions to author report or label templates can trigger the WeasyPrint report rendering process to retrieve resources selected by an attacker via HTTP, HTTPS, or local file URI schemes. The HTML(string=html).write pdf() path lacks a restricted url fetcher, and the attach to model=True setting stores the original generated PDF. This allows for the recovery of fetched local files or internal HTTP response bodies from embedded attachments, leading to full-read server-side request forgery (SSRF), arbitrary local file disclosure including application credentials, and potential compromise of superuser accounts.

Recommendations Update to version 1.4.0.